Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 60.5.0.

Security Fix(es):

• Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500)
  
• Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501)
  
• Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)
  
• libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Yaniv Frank (SophosLabs), Alex Gaynor, Christoph Diehl, Steven Crane, Jason Kratzer, Gary Kwong, Christian Holler, and Jed Davis as the original reporters.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64

Fixes

• BZ - 1375120 - CVE-2016-5824 libical: Multiple use-after-free vulnerabilities
• BZ - 1670631 - CVE-2018-18500 Mozilla: Use-after-free parsing HTML5 stream
• BZ - 1670632 - CVE-2018-18501 Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5
• BZ - 1670633 - CVE-2018-18505 Mozilla: Privilege escalation through IPC channel messages

CVEs

• CVE-2016-5824
• CVE-2018-18500
• CVE-2018-18501
• CVE-2018-18505

References

• https://access.redhat.com/security/updates/classification/#important
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-03/

Red Hat Enterprise Linux Server 7

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8

Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8

Red Hat Enterprise Linux Server - AUS 7.6

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8

Red Hat Enterprise Linux Workstation 7

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8

Red Hat Enterprise Linux Desktop 7

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8

Red Hat Enterprise Linux for Power, little endian 7

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
ppc64le
thunderbird-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 066a60d88d64024b6970d9c54e8e129fdf3e68d5825c9922e3bc510d8eed9aad
thunderbird-debuginfo-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 37e042e21be39441878f805ed15582611977d519e1d1fb8a9655aa734c9bf74d

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
ppc64le
thunderbird-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 066a60d88d64024b6970d9c54e8e129fdf3e68d5825c9922e3bc510d8eed9aad
thunderbird-debuginfo-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 37e042e21be39441878f805ed15582611977d519e1d1fb8a9655aa734c9bf74d

Red Hat Enterprise Linux Server - TUS 7.6

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8

Red Hat Enterprise Linux for ARM 64 7

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
aarch64
thunderbird-60.5.0-1.el7_6.aarch64.rpm	SHA-256: 4e388358566b0d5123c6f223f531e4bb9e576bf283fe361ee77c272d226cb751
thunderbird-debuginfo-60.5.0-1.el7_6.aarch64.rpm	SHA-256: fb0ca13ca55376de2a95dd1940ed314e0196a761dc7695e122c5a14a33c3af90

Red Hat Enterprise Linux for Power 9 7

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
ppc64le
thunderbird-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 066a60d88d64024b6970d9c54e8e129fdf3e68d5825c9922e3bc510d8eed9aad
thunderbird-debuginfo-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 37e042e21be39441878f805ed15582611977d519e1d1fb8a9655aa734c9bf74d

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
ppc64le
thunderbird-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 066a60d88d64024b6970d9c54e8e129fdf3e68d5825c9922e3bc510d8eed9aad
thunderbird-debuginfo-60.5.0-1.el7_6.ppc64le.rpm	SHA-256: 37e042e21be39441878f805ed15582611977d519e1d1fb8a9655aa734c9bf74d

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6

SRPM
thunderbird-60.5.0-1.el7_6.src.rpm	SHA-256: e84bbfcfd1afb4a37ea1ed4eb91043f9168d3d23cddc8e34e4ec0f3d15cfc1c8
x86_64
thunderbird-60.5.0-1.el7_6.x86_64.rpm	SHA-256: 1902ecbdb90613a710020817d3d4638b544842ab0ebb4b1c522a15fedccdd583
thunderbird-debuginfo-60.5.0-1.el7_6.x86_64.rpm	SHA-256: b71d221c63badf4fe0f16ea5fa9ad6c7bebf189ef7ad005fee0604a2046c11c8